Collectives pages become unreadable

[greenlilyy]

Describe the bug
When using Collectives with Server Side Encryption (Master Key) enabled, some users can see the page tree and page titles but cannot read the page content.

The page opens, but the content is empty and Nextcloud logs the following exception:

OC\Encryption\Exceptions\DecryptionFailedException
Cannot decrypt this file, probably this is a shared file.
Please ask the file owner to reshare the file with you.

The behaviour is inconsistent:

the affected user can read pages they created themselves.
other members cannot read pages created by this user.
the affected user cannot read pages created by other members.
other members can collaborate normally with each other.

Even more confusing:

a newly created page is initially readable by everyone.
after a few minutes, the page becomes unreadable for the affected user.
the page title remains visible but the content is empty.

This only happens for one LDAP user. Other users work normally.

To Reproduce
Steps to reproduce the behavior:
Unfortunately, we have not found a reliable way to reproduce the issue from scratch.

Observed scenario:

Server Side Encryption (Master Key) enabled.
LDAP users.
Create a Collective.
Several users edit pages.
One specific LDAP user starts being unable to read pages created by other users.
Other users also cannot read pages created by this user.
New pages may initially work, but after a few minutes they become unreadable.

Expected behavior
All members of the Collective should be able to read and edit pages according to their permissions.

No decryption error should occur.

Server details:
Collectives app version: 4.4.1
Nextcloud version: 32.0.6.1
PHP Version: (fill with php -v)
Database: MariaDB (please specify version)

Client details:
LDAP / Active Directory authentication
Server Side Encryption enabled
Master Key mode
Cron background jobs enabled and running correctly

Nextcloud log (data/nextcloud.log)

Nextcloud log
OC\Encryption\Exceptions\DecryptionFailedException

Cannot decrypt this file, probably this is a shared file.
Please ask the file owner to reshare the file with you.

Stack trace:

OC\Encryption\Exceptions\DecryptionFailedException
Cannot decrypt this file, probably this is a shared file.
Please ask the file owner to reshare the file with you.

...
(data/http/nextcloud/apps/encryption/lib/Crypto/Encryption.php:315)

Browser log

No Javascript errors.

The request succeeds but the page content cannot be decrypted.

[max-nextcloud]

Hi @greenlilyy

Thanks for the feedback and checking in. There's quite a few issues with regards to server side encryption

They all result from the same fundamental problem. Encryption keys are stored by the files encryption app based on the file path. Since collectives allows changing the folder where collectives are stored and collectives can be renamed the paths might be different for different users and change over time.

While we're working on a fix for the underlying problem there are some things you can do to mitigate the problem:

• Ensure everyone is using the same Collective folder as configured at the bottom of the collectives list:
  
• If you've upgraded from Collective 3.x to 4.x make sure to migrate the encryption keys was well.
• Try to avoid renaming collectives or migrate the keys afterwards.

In general try to avoid server side encryption unless it's really relevant for your threat model (i.e. you are storing data on an external storage you do not trust). If you host Nextcloud on a vm or you own server using full disk encryption is probably the better option.

I hope some of these hints are helpful to you.

[rumbertl]

I have currently the same problem and did fight for a few hours now.
To change the name of Folder (just create a new one, and changed the config in the Collectives Settings).
We now force the whole Nextcloud to One Language